docs: def validate_request(request):
      """Check an incoming request.
  
      Returns:
          - True if authentication passed
          - Adding request['REMOTE_USER'] as authenticated username.
      """
      if getattr(settings, 'BASICAUTH_DISABLE', False):
          # Not to use this env
          return True
  
      if 'HTTP_AUTHORIZATION' not in request.META:
          return False
  
      authorization_header = request.META['HTTP_AUTHORIZATION']
      ret = extract_basicauth(authorization_header)
      if not ret:
          return False
  
      username, password = ret
  
      raw_pass = settings.BASICAUTH_USERS.get(username)
      if raw_pass is None:
          return False
  
      # To avoid timing atacks
      # https://security.stackexchange.com/questions/83660/simple-string-comparisons-not-secure-against-timing-attacks
      if not constant_time_compare(raw_pass, password):
          return False
  
      request.META['REMOTE_USER'] = username
      return True